/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

0 vote150 views1 answer
Abbreviated stat for git
Shell/Bash
47 votes177 views9 answers
Cannot be loaded because running scripts is disabled on this system
Shell/Bash
1 vote166 views2 answers
Kivy install ubuntu 20
Shell/Bash
0 vote146 views1 answer
Bash ls show link
Shell/Bash
1 vote144 views2 answers
Heroku buildpacks
Shell/Bash
16 votes149 views5 answers
Tkinter download windows 10 64-bit
Shell/Bash
0 vote156 views1 answer
Find syntax unix
Shell/Bash
11 votes153 views6 answers
How to untrack a file in git
Shell/Bash
0 vote155 views1 answer
Setting Flask app variable
Shell/Bash
0 vote149 views1 answer
Mongodb stop server mac
Shell/Bash